Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 06:10
Static task
static1
Behavioral task
behavioral1
Sample
2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe
Resource
win7-20230831-en
3 signatures
150 seconds
General
-
Target
2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe
-
Size
700KB
-
MD5
f976b4f177f79502215c7d2d9e93ee16
-
SHA1
97f888337aae22e27eed57deb4b85cdff13c576a
-
SHA256
2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582
-
SHA512
e41bcc684fcf5651f0812beb4d97fae71122dc5468c185e250071d2c69f8b3c5d2237a052b90fa3cb674c4d956c5caa17190aa28f8c07c02c97ad17b6bb6754a
-
SSDEEP
6144:9SvGAafgBMniUwluzlcy/XVucQ5p6SLGn+xfhXr3uwlLycLRLy9vfz:4Gfg2i8VucQ5p60V3usLBcNz
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2252 set thread context of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 -
Program crash 2 IoCs
pid pid_target Process procid_target 3008 2252 WerFault.exe 2 2188 1048 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 1048 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 29 PID 2252 wrote to memory of 3008 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 30 PID 2252 wrote to memory of 3008 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 30 PID 2252 wrote to memory of 3008 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 30 PID 2252 wrote to memory of 3008 2252 2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe 30 PID 1048 wrote to memory of 2188 1048 AppLaunch.exe 31 PID 1048 wrote to memory of 2188 1048 AppLaunch.exe 31 PID 1048 wrote to memory of 2188 1048 AppLaunch.exe 31 PID 1048 wrote to memory of 2188 1048 AppLaunch.exe 31 PID 1048 wrote to memory of 2188 1048 AppLaunch.exe 31 PID 1048 wrote to memory of 2188 1048 AppLaunch.exe 31 PID 1048 wrote to memory of 2188 1048 AppLaunch.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe"C:\Users\Admin\AppData\Local\Temp\2a2dbd71fae9cff300cb5ed2a2f8896bb62ce5f1b43e7be87946dfe4aecbd582.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 1963⤵
- Program crash
PID:2188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 922⤵
- Program crash
PID:3008
-